Suspicious Deno File Written from Remote Source (via file_event)

title: Suspicious Deno File Written from Remote Source (via file_event)
id: 8a11c2ef-bf50-55aa-979d-4c0ab42c5731
status: stable
description: This rule detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own hostile DLL. This behavior may indicate an attempt to execute remotely hosted, potentially hostile files through deno.
references:
    - https://attack.mitre.org/techniques/T1105/
    - https://attack.mitre.org/techniques/T1059/007/
    - https://attack.mitre.org/techniques/T1204/
    - https://taggart-tech.com/evildeno/
author: Huntrule Team
date: 2026-04-23
tags:
    - attack.execution
    - attack.t1204
    - attack.t1059.007
    - attack.command-and-control
    - attack.t1105
logsource:
    category: file_event
    product: windows
detection:
    selection_path:
        TargetFilename|contains:
            - '\deno\gen\'
            - '\deno\remote\https\'
        TargetFilename|contains|all:
            - ':\Users\'
            - '\AppData\'
    condition: selection_path
falsepositives:
    - Unknown
level: low